Monitor The Microsoft Entra ID SAML certificates expiration

How can I monitor the SAML certificates expiration in Microsoft Entra ID? I happened to see this post here Monitor The Azure Active Directory Client Secret Expiration (c-sharpcorner.com) and would like to do the same using Azure Function Apps and Azure Logic Apps, but I am new to Powershell so asking little help. In Azure Portal, there is already an expiration date display for the certain certificate and would like to get all applications that certificates are near expiry (maybe will expire on 60 days). Thanks in advance.

Monitoring SAML certificate expiration in Microsoft Enterprise Identity (formerly known as Azure AD) can be crucial for ensuring the security and reliability of your applications. Here's a general approach using Azure Functions and Azure Logic Apps to achieve this:

Azure Function App:
- Create an Azure Function App that will execute a PowerShell script to retrieve the list of applications and their associated SAML certificates from Microsoft Enterprise Identity.
- The PowerShell script should query the Enterprise Identity API to retrieve application details including certificate expiration dates.
- The script should filter out applications with certificates that will expire within the specified timeframe (e.g., 60 days).
Azure Logic App:
- Create an Azure Logic App that will trigger the Azure Function periodically (e.g., daily) to check for expiring SAML certificates.
- Use the "HTTP" trigger in the Logic App to call the Azure Function endpoint.
- Receive the list of applications with expiring certificates from the Azure Function.
- Implement logic in the Logic App to send notifications (e.g., email, Teams message) to relevant stakeholders about the expiring certificates.

1 Reply

Know the answer? Post it — somebody with the same question will find it here.

Abhishek Chadha2y ago
Accepted answer
Monitoring SAML certificate expiration in Microsoft Enterprise Identity (formerly known as Azure AD) can be crucial for ensuring the security and reliability of your applications. Here's a general approach using Azure Functions and Azure Logic Apps to achieve this:
1. Azure Function App:
  
  Create an Azure Function App that will execute a PowerShell script to retrieve the list of applications and their associated SAML certificates from Microsoft Enterprise Identity.
  
  The PowerShell script should query the Enterprise Identity API to retrieve application details including certificate expiration dates.
  
  The script should filter out applications with certificates that will expire within the specified timeframe (e.g., 60 days).
2. Azure Logic App:
  
  Create an Azure Logic App that will trigger the Azure Function periodically (e.g., daily) to check for expiring SAML certificates.
  
  Use the "HTTP" trigger in the Logic App to call the Azure Function endpoint.
  
  Receive the list of applications with expiring certificates from the Azure Function.
  
  Implement logic in the Logic App to send notifications (e.g., email, Teams message) to relevant stakeholders about the expiring certificates.